iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nfsd4: fix bad pointer on failure to find delegation

Browse Source 
In case of a nonempty list, the return on error here is obviously bogus;
it ends up being a pointer to the list head instead of to any valid
delegation on the list.

In particular, if nfsd4_delegreturn() hits this case, and you're quite unlucky,
then renew_client may oops, and it may take an embarassingly long time to
figure out why.  Facepalm.

BUG: unable to handle kernel NULL pointer dereference at 0000000000000090
IP: [<ffffffff81292965>] nfsd4_delegreturn+0x125/0x200
...

Cc: stable@kernel.org
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
This commit is contained in:
J. Bruce Fields 2011-03-06 19:11:03 -05:00
parent 2c9c8f36c3
commit 32b007b4e1
1 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
fs/nfsd/nfs4state.c
View File

@ -2445,15 +2445,16 @@ nfs4_check_delegmode(struct nfs4_delegation *dp, int flags)
static struct nfs4_delegation *
find_delegation_file(struct nfs4_file *fp, stateid_t *stid)
{
struct nfs4_delegation *dp = NULL;
struct nfs4_delegation *dp;
spin_lock(&recall_lock);
list_for_each_entry(dp, &fp->fi_delegations, dl_perfile) {
if (dp->dl_stateid.si_stateownerid == stid->si_stateownerid)
break;
}
list_for_each_entry(dp, &fp->fi_delegations, dl_perfile)
if (dp->dl_stateid.si_stateownerid == stid->si_stateownerid) {
spin_unlock(&recall_lock);
return dp;
}
spin_unlock(&recall_lock);
return dp;
return NULL;
}
int share_access_to_flags(u32 share_access)